Safety timer crosscheck diagnostic in a dual-CPU safety system

A method of operating a safety device having a first and second processing unit, each including an independent processor, memory and single clock source, the memory of each of the first and second processing units loadable with a first and second safety program and input/output variables, the safety programs being repeatedly executable to read input variables representing inputs from external controlled devices and write output variables representing outputs to external controlled devices, the method comprising the steps of:

• a) synchronizing the first and second processors;
• b) loading the first and second processors with first and second predetermined interrupt times;
• c) executing at least one loop of both safety programs,
• d) interrupting the first processor after the first interrupt time has elapsed as perceived by the first processor;
• e) sending a signal to the second processing unit;
• and
• f) determining whether the first interrupt time as measured by the second processor substantially equals the first interrupt time of the first processor as measured by the first processor.

An I/O module comprising:

• a first processing unit having a first processor driven by a first clock source;
• a second processing unit having a second processor independent from the first processor driven by a second clock source independent from the first clock source;
• and
• a diagnostic running in the first and second processing units;
• wherein the diagnostic validates the accuracy of each clock source.